Comment by IMTDb | Hacker News Reader

Comment by IMTDb | Hacker News Reader

Parent Full thread

Me experience is the exact opposite.

As a user:

- If I need the service and only intend to use it for a very small project, I love forever free plans. Because I know I can subscribe use your server time and forget my account forever. I often subscribe with a temp email so that I don't even receive your emails anymore.

- If I seriously need the service and is ready to pay for it, I don't really care about the free forever plan vs free trial vs paid trial.

As a business:

- Any time I have offered a free forever plan, basically 95% of the created accounts are dormant free accounts (like I personally am when I find the correct tool to scratch my itch). 4% are from people (usually from south east asia) creating hundreds/thousands of accounts (sometimes manually !) to circumvent the free plan limitations instead of just paying for the service. And 1% are from legitimate users/customers.

- People in the 95 and 4% categories still believe they are owed support. And if you don't give them an easy way to let them contact you, they now have twitter and facebook and business reviews websites to get to you. On top of emails, LinkedIn messages and yes, phone calls.

- Cutting the free accounts has almost no impact on real customers acquisition. You can let people experience your product with a temporary trial, that includes support and way more features, but behind the credit card screen. Extend the free trial as much as needed if people ask for it through your usual support channel. You will still get abusers but those are easier to detect, because they need to provide some payment details which are harder to fake, and after you shut them down for the third time in a row, they usually go away.

How do you feel about a free-forever plan behind a credit card screen?

Google Cloud is this way: stay below their free usage limits for some services and you'll never need to pay; but you need to give them your card up-front because it's a post-paid service and they need to ensure they can charge you if-and-when you do go over those limits.

Or, for another approach: how about a plan that's free, but where there's a small one-time fee on signup, regardless of the plan you choose? (You can be upfront to your users and tell them it's a KYC measure, if you like.)

Or, how about a free service, but gated with a real KYC/AML process on signup (of the "sign in through your bank" or "upload your driver's license to this third party" variety.)

Any of these approaches, IMHO, would filter out the 4% of spammers; and also act as a barrier to anyone who isn't serious about eventually trying the service — while not being as much of a barrier to people like the GP poster, who take five months to get around to testing a service before becoming a diehard fan of it, and don't want to be paying for those five months, but also look in apprehension at the idea of possibly having to spend time trying to get their (as-yet-unused) trial extended.

This might work in a B2B relationship but as an individual, there is no site on earth that is getting me to give you my bank account or driver's license info as part of a "free" or "trial" plan.

Maybe. MAYBE. I'll give you a credit card number since I know I can always dispute/chargeback if you turn out to be dishonest. No way do you get anything that can't be 100% undone within a few minutes.

> give you my bank account or driver's license info as part of a "free" or "trial" plan.

Re: bank accounts, nobody was suggesting that, that's not how KYC systems work. Re: driver's license info, that's not quite how (well-implemented, modern) KYC flows work, either.

For "signing up using your bank", I wasn't talking about giving the service a photo of a void cheque or anything; I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider, through a SAML broker.

I don't know if this is common anywhere else, but in Canada we have a pretty popular SAML SSO broker doing this (https://securekey.com/) ; it allows you to use all our major banks as SSO authentication agents (works with both web and mobile-app flows); and this SSO method is in use for many government sites (e.g. it's how you log in to file your taxes, pay federal student loans, etc.) Any (Canadian) business can actually add SSO to their site/app through this broker. And, just like with any other (good) SSO method, the app being signed into through the SSO broker doesn't receive your credentials.

Re: driver's license info, with regular KYC flows, you don't upload your driver's license info to the first party. Instead, you're directed to a trusted neutral third party (the KYC/AML provider), who has their own app; you give your credentials to that service, through its own app, which is essentially the account-creation flow for your account with that service; and then the first-party service you were interacting with SSOs you through the KYC service as an OAuth/OIDC flow.

I'm not familiar enough with SSO flows to be able to quantify any kind of risk, but it makes me very uneasy when things interconnect with my bank. Everything always seems secure until it isn't.

I don't mean to spread FUD, it just seems needlessly risky to make banks the central point of auth.

It really isn't/ shouldn't be.

In theory, the bank is really incentivized to provide proper and secure authentication (if someone can impersonate you to your bank, you're kinda screwed anyway). So, it only makes sense to trust a bank to provide the authentication service. One should realize that SSO integration with a bank doesn't mean 3rd party has any sort of access to the bank - it' just means that you authorize your bank to tell a 3rd party "yes, I believe this is really curryst"). Doesn't increase the attack surface for you - it only increases the "blast radius" if someone successfully compromises your bank account. But that one is typically already a dire situation.

It does increase the risk for you, the same way using Google or Facebook account does.

Once the bank won't authenticate you for some reason, all the accounts bound to this SSO provider also go the way of dodo.

> I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider

Personally, I use my bank only for banking and would never ever consider using them as an SSO provider. They handle my money, I don't want them to handle anything else or have any more information about me than they already do. Also, in my personal experience, the banks aren't very technologically competent, so the less they are expected to do, the better.

What's your use case for the "one time fee"? Is this a barrier to prevent bad actors?

I can easily see use cases where someone without buying power can get a 50, maybe even 100 USD bond or 'license' of some sort PROVIDED that there's either only one or even more ideally a set of competitors who's "not a bad actor" licenses are interoperable; and work on the whole Internet for that task (without expiring until bad karma is dinged).

However no, nickle and dime-d to death, as well as those 'free but remember to cancel' plans, are the exact reason I'd never hand over real billing info until I'm serious about being billed.

The one-time fee is an e-stamp, basically. It makes having N identities N times as expensive as having one. It's one of the oldest anti-spam suggestions, from before spam filters were invented.

What you're talking about with that "license" is exactly what you get by everybody relying on a small set of KYC providers; except that the KYC provider doesn't charge you for registration, but instead requires a Proof-of-Stake in some state's legal system (i.e. a set of documents that require laborious up-front proofs to acquire, such that it's very hard to acquire two sets of them, but which can be used to validate identity freely once issued.)

KYC providers that just charge $100 instead of requiring a Proof-of-Stake challenge exist, too. That's essentially the (secondary?) purpose of businesses that will only trade with other incorporated businesses (or, to abstract that away, only with businesses that have a Dun & Bradstreet DUNS number): it costs $100 to incorporate, or to register one of those numbers, so you have to be at least $100 of serious to bother them, and you can't just keep spending hundred-dollar-bills forever to keep generating new identities to DDoS someone.

What I haven't heard of, interestingly, is a KYC provider that requires a proof of work. Something like "solve a thousand Captchas to create an account." Or a formalized version of the old "take a photo of yourself holding up today's newspaper." But that'd be totally workable as well.

I treat 'free but remember to cancel' plans as scams.

About 10 months ago I got emails from a company that developed an development environment that was I was mildly interested in. They presented an offer with said it was free so that people could help educate themselves during lockdown. Unfortunately the terms was after 1 year you needed to pay something like $1500 if you didn't cancel, these terms were right at the bottom of the page and very hard to spot. Paid through PayPal and the about $1500 was there right in front of me. I cancelled it on the same day.

A company offering that sort of deal waiting for people not to cancel and saying it is to help people during the lockdowns is just awful.

> Any time I have offered a free forever plan, basically 95% of the created accounts are dormant free accounts (like I personally am when I find the correct tool to scratch my itch).

What's the issue? Unused account shouldn't be a big spending. If it become one, take a bit of time to change it a bit (delete data/stop service after a set amount of inactivity) and use that occasion to send them an email that remind them that your service exist.

Reply on news.ycombinator.com